You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 21, 2017

Conducting Successful Corporate Internal Investigations in Southeast Asia

Informed Counsel

Employees, managers, and the companies they work for sometimes do bad things.   Employees might embezzle money or sell trade secrets to competitors. Executives may authorize a bribe to win a contract, or tacitly approve accounting trickery to make finances appear better than they really are. From stealing petty cash out of a lockbox to multimillion dollar bribery scandals, there are innumerable ways for employees and companies to commit misdeeds. According to PwC’s 2016 Global Economic Crime Survey, almost 80% of incidents of wrongdoing in Thailand occurred within organizations—this compares to 46% globally.

Why Investigate?

If general counsel or management is confronted by suspicious circumstances, whether revealed by a whistleblower complaint or an audit, what should they do? The recommended first step is usually to investigate. The goal of any good internal corporate investigation is to determine the facts: what happened, who was involved, when did the events occur, and why.

Based on the answers to these questions, management can then decide how to respond. Perhaps the facts will exonerate an employee who was wrongfully accused by a colleague with a gripe. Or maybe the investigation will reveal a deep-rooted problem within the organization that has the potential to cause lasting legal, commercial, and reputational damage. Whatever the case may be, to address the problem, the company has to first learn about it.  

Getting to the truth has many commercial and legal benefits. An investigation can help to excise wrongful conduct from an organization, weeding out the bad apples. Investigations will also help companies prepare for any potential governmental action. An organization would be far better equipped to deal with regulators if the facts are already known. The same applies for reputational damage. It is easier for a company to control the public narrative when it already knows what happened, instead of the facts being revealed by the media or government.

While thorough investigations are certainly advantageous, they can also be difficult, expensive, resource-intensive, and time-consuming. These challenges are magnified when the investigations take on an international character. Varied legal systems and cultural norms will always have to be considered. In Southeast Asia, for example, laws and cultures are extraordinarily diverse. Handling an employee interview in Thailand should be different than approaching a similar interview in Vietnam or Cambodia.

The Investigation Plan

With these challenges in mind, each investigation should start with a carefully drafted plan. While the temptation to rush into the investigation may be strong, and time-sensitivity is certainly an issue, having a well-thought plan is critical. Advance planning will reduce the risks of mistakes that can sink the investigation. Such a plan also has the benefit of showing regulators, shareholders, and other stakeholders that the organization took the investigation seriously and was committed to reaching the truth. While the investigation plan should be flexible enough to consider changing circumstances, it should also be sufficiently defined to avoid unintentionally widening its scope.

When crafting the plan, the nature of the wrongdoing must be considered. While all allegations or suspected misconduct should be evaluated on some level, generally, the more serious the issue, the more extensive the investigation. Matters relating to regulatory or reputational risks—such as corruption allegations—will warrant a more comprehensive investigation. Determining whether a low-level employee fudged a few dollars on an internal expense form would likely not involve a significant cross-border probe. The best practice would be for an organization to have policies and procedures in place that would help determine how an investigation should be conducted.

Another important planning issue is the investigation’s scope. Will the investigation look to turn over every rock over the last decade? Or will the scope be narrow, and only extend to a particular action by one employee? The investigation’s scope will also depend on the wrongdoing. For bribery and fraud cases that may have occurred over extended periods of time, the scope would be more extensive than one-off instances of employee misconduct. In many cases, an investigation’s scope may widen as the search for facts proceeds.

Companies also must consider who will be the investigator. The investigator should be viewed as someone independent. At a minimum, the investigator should not report to the person or persons being investigated. Depending on the nature of the investigation, external counsel can be a good choice, especially when legal violations are involved. Of course, external counsel will increase the cost of the investigation, and may not be necessary for small-scale, low-risk matters. Other benefits of external counsel include a greater likelihood of examining a company objectively, without being hampered by an organization’s internal politics.

Planning Cross-Border Investigations

For cross-border investigations, the use of local external counsel is often necessary. In addition to being able to advise on the law, local counsel will know the language and cultural and business norms. These skills are crucial when handling witness interviews and dealing with local regulators and business partners. For cross-border investigations, it is recommended that local counsel assist with preparing the investigation plan.

Local law should be considered when planning a cross-border investigation. In Thailand and Vietnam, for example, employees have significant legal protections. If the investigation team does not tread carefully, they may cause the company to be on the receiving end of a civil, or even criminal, labor-related court case. Other important legal considerations include data privacy and legal privilege. And there are often additional jurisdiction-specific legal considerations.

Another risk is for an employee (usually the investigation’s target) to seek the intervention of local government officials. To deflect from the investigation, a targeted employee may submit allegations of a company’s regulatory noncompliance to authorities in areas unrelated to the investigation. This tactic is common in Thailand and Vietnam. The end result is that the investigating company itself becomes a target of a government investigation.

Planners considering a cross-border investigation should also have complete knowledge of any targeted local subsidiary’s business organization and partnership. In Thailand, businesses in many sectors must be “locally owned,” where a majority of shares are owned by a local Thai partner. The investigation planning team must consider any implications of the investigation on the joint venture relationship. For example, issues that should be considered include whether there is a shareholders’ agreement or joint venture contract that is relevant to the investigation; and what the investigators should do if a joint venture partner blocks the investigation.

Another critical aspect to planning the investigation is identifying the witnesses/employees to be interviewed and gathering the relevant documents. These are ongoing processes. As more facts are uncovered, more names often appear. Investigators will have to meticulously compile and study all documents, continuously looking for evidence.

Interviews

A central component of the investigation is the witness interview. Witness interviews should be done after all relevant documents have been compiled and thoroughly reviewed. Without preparation, the interview will be useless. An interview question outline should be prepared in advance, based on the evidence.

Just as important as the interview is the written interview report. Memories are not reliable, so the reports serve as the written record of the interview. And when the interview reports are examined in conjunction with each other, the facts often become clearer.

Part of the art of witness interviews involves understanding cultural nuances. This is especially important in cross-border investigations, where an overseas parent company (or law firm) investigates conduct in a local subsidiary. The parent entity may not fully understand issues unique to the local jurisdiction. This includes labor and employment law, privacy matters, and, of course, language. Understanding the local culture and how to effectively communicate with and question employees will also yield much more effective interviews. For these reasons, it is always recommended for local counsel to assist when conducting interviews with local employees.

Closing the Investigation

The investigator should document each step of the investigation process. Documenting the investigation creates a permanent record of what is being uncovered, how the information is being unveiled, and who is revealing what. The end result is compiled into a report, which can either be written or presented verbally to the company’s directors. Whether the report is written or verbal depends on the nature of the investigation. A written report, for example, can be used as evidence to discipline an employee, build a legal case, disclose to shareholders, or address systemic company shortcomings, among other things. But the risk is that the written report may become discoverable by opposing parties or regulators.

Conclusion

In conclusion, investigations are a critical component of how a company uncovers wrongdoing. Investigations not only help eliminate wrongful behavior, but also show employees that the organization takes misconduct seriously. What is more, with an investigation a company can show the public at large that it will resolutely address allegations of misconduct. This can help the organization distance itself from the bad act. Most importantly, investigations encourage a culture of transparency and accountability, which not only limits liability but is ultimately beneficial for the long-term success of the business.

The author would like to thank Mark Hsien for his assistance with the research for this article.

RELATED INSIGHTS​ 

June 16, 2025
Thailand has amended its primary anticorruption law to provide robust new protections and direct assistance to whistleblowers. The Organic Act on Anti-Corruption (No. 2) B.E. 2568 (2025) was published in the Government Gazette on June 5, 2025, and came into force the following day. The amendment introduces a clear framework for safeguarding and supporting individuals who report graft. The amendment addresses a critical gap in the previous legislation by establishing formal mechanisms to protect and assist those who come forward with information. The key changes aim to shield whistleblowers from retaliatory legal and disciplinary actions, thereby encouraging more citizens to participate in exposing corruption without fear of reprisal. Key updates to the law are discussed below. Whistleblower Immunity The amendment clarifies and strengthens legal immunity by revising section 132 of Thailand’s original anticorruption law from 2018. Under the revised section, individuals who provide good-faith statements, information, evidence, or opinions to the National Anti-Corruption Commission (NACC) regarding offenses under its jurisdiction will be protected from civil, criminal, and disciplinary liability. This protection is explicitly extended to individuals who provide information to other state agencies tasked by the NACC to investigate corruption, such as the Public Sector Anti-Corruption Commission or the whistleblower’s own supervisors. Protection and Assistance A new section added to the law establishes a clear and swift process for activating protections. When the NACC learns that a whistleblower is facing legal complaints, criminal charges, or disciplinary action due to their report, the commission must review the matter and decide on providing protection within 15 days. If the NACC determines that the whistleblower acted in good faith, its office is required to provide immediate assistance. Legal and Financial Support Another newly introduced section outlines a wide range of assistance measures the NACC office can provide in civil and criminal cases
June 13, 2025
In today’s digital age, cyberattacks have become a real threat to organizations worldwide. These attacks can range from phishing and malware to ransomware and distributed denial of service (DDoS) attacks. As the frequency and sophistication of these attacks increase, so does the importance of cybersecurity compliance. In the corporate world, compliance refers to the process of ensuring that a company and its employees adhere to all relevant laws, regulations, standards, and ethical practices—but it should not stop there. Compliance should also encompass asset recovery and disciplinary measures, which can both help organizations address incidents effectively and promote good governance. Cyberattacks are malicious attempts to access or damage a computer system or network, often carried out for financial gain, for political activism, or simply to cause disruption. For instance, a successful attack might involve an attacker creating an email address that closely resembles a legitimate one, perhaps by changing only one or two characters. That email address is then inserted into an existing conversation thread, making it appear as if the user with this email address was already part of the discussion. This tactic can easily deceive a recipient into believing the email was sent from a trusted source, thereby leading them to click on malicious links, provide sensitive information, or even make payments in accordance with the attacker’s request or instructions. Phishing attacks like these are particularly dangerous and can have a serious impact on the ongoing business of a corporation because they exploit the trust and familiarity established in the original email chain. Effective Mitigation Approaches Mechanisms for addressing the aftermath of a crisis provide important recourse to affected organizations, but effective compliance mechanisms can minimize the risk of such crises ever occurring. Companies should therefore prioritize preventative measures and implementation of effective crisis management schemes. Various legal
June 11, 2025
Thailand’s tax dispute resolution framework has undergone a significant transformation with the enactment of the Act Establishing the Tax Court and the Procedure for Tax Cases (No. 3) B.E. 2568. Published in the Government Gazette on May 27, 2025, the amended act will come into force on November 24, 2025, which is 180 days after its publication. The amended act marks a pivotal shift in the jurisdiction and procedures of the Tax Court, most notably by empowering it to adjudicate certain criminal tax cases for the first time. Background and Rationale The Tax Court was originally established in 1985 as a specialized forum to handle complex tax disputes, including those related to revenue, customs, and excise taxes. The creation of the Tax Court recognized the need for judicial expertise in tax law, given its technical and specialized nature. The latest amendment is designed to address procedural inefficiencies, modernize court processes, and align Thailand’s tax litigation system with international standards. The reform demonstrates Thailand’s commitment to enhancing the efficiency, transparency, and fairness of its tax dispute resolution mechanisms. Key Amendments and Provisions Six of the key changes in the amendment are highlighted below. Expansion of jurisdiction to criminal tax cases. The most significant change is the extension of the Tax Court’s jurisdiction to include criminal offenses under the Revenue Code, customs law, excise tax law, and other tax-related laws that may be specified by royal decree. New sections in the act explicitly grant the Tax Court authority to hear and decide criminal tax cases, so individuals and entities accused of criminal tax evasion or other tax-related crimes will now have their cases heard by judges with specialized tax expertise. The law also clarifies the Tax Court’s jurisdiction when a single act constitutes multiple offenses (some tax-related, some not) or when
June 6, 2025
As from July 1, 2025, as part of its ongoing efforts to digitalize and streamline the delivery of public services, the Vietnamese government will officially conduct administrative procedures, both online and offline, only via electronic identity (“e-ID”) accounts on the VNeID platform. In particular: Online administrative procedures carried out via the National Public Service Portal or via information systems for administrative procedures at the ministerial or provincial level are required to be implemented by using e-ID accounts only. When receiving dossiers, authorities will be required to check and verify the e-IDs of companies or individuals responsible for conducting administrative procedures. Further, it is worth noting that to complete the registration of an e-ID account for a company, the legal representative of the company must hold a level-2 e-ID account. Compliance Considerations Vietnam’s first regulation of e-ID accounts for individuals and organizations was issued in Decree No. 59/2022/ND-CP dated September 5, 2022, on electronic authentication and identification. This decree was subsequently replaced by Decree No. 69/2024/ND-CP dated June 25, 2024, which governs the same matters. Registration and operation of e-ID accounts are centralized through VNeID, a digital ID app developed by the National Population Data Center under the Ministry of Public Security of Vietnam. Although the registration of e-ID accounts for companies is not explicitly mandated by law, the absence of an e-ID account may hinder companies from completing administrative procedures, including licensing and reporting obligations. Such non-compliance could consequently result in administrative penalties. To mitigate unexpected non-compliance and administrative fines due to the lack of an e-ID account, companies should be well prepared for and implement the registration of a company e-ID account as soon as possible.